RANSOM_CRYPWALL.YUYAGA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution. It is capable of encrypting files in the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops and executes the following files:

• %Desktop%\HELP_YOUR_FILES.TXT
• %Desktop%\HELP_YOUR_FILES.HTML
• %Desktop%\HELP_YOUR_FILES.PNG

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random characters}\{random characters}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = "%Application Data%\{random characters}\{random characters}.exe"

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

Dropping Routine

This Trojan drops the following files:

• %User Startup%\HELP_YOUR_FILES.TXT
• %User Startup%\HELP_YOUR_FILES.HTML
• %User Startup%\HELP_YOUR_FILES.PNG
• HELP_YOUR_FILES.PNG - drops to all folders where files are encrypted

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://www.{BLOCKED}e.sh/
• http://blog.{BLOCKED}l.com/NFDayU.php?{random letter}={random values}
• http://{BLOCKED}mission.org/VImTSM.php?{random letter}={random values}
• http://{BLOCKED}fullofcarrots.ch/OIP7rk.php?{random letter}={random values}
• http://{BLOCKED}x.kz/Ov8_qV.php?{random letter}={random values}
• http://{BLOCKED}nk.us/9X2kNr.php?{random letter}={random values}
• http://{BLOCKED}anykaprun.cz/LV6Egb.php?{random letter}={random values}
• http://{BLOCKED}a.com.au/rxo5Zp.php?{random letter}={random values}
• http://{BLOCKED}r-consulting.com/1r432c.php?{random letter}={random values}
• http://{BLOCKED}x.com/VWuyK4.php?{random letter}={random values}
• http://{BLOCKED}nvieira.com.br/6CvxuN.php?{random letter}={random values}
• http://{BLOCKED}orestclocks.org/K6lWQg.php?{random letter}={random values}
• http://{BLOCKED}szen.com/AMx5jI.php?{random letter}={random values}
• http://{BLOCKED}to90210.altervista.org/bJT1VS.php?{random letter}={random values}
• http://{BLOCKED}ay.sk/mE8MKJ.php?{random letter}={random values}
• http://{BLOCKED}eveda.com/i5amQC.php?{random letter}={random values}
• http://{BLOCKED}istictraining.com/c0Mdwh.php?{random letter}={random values}
• http://{BLOCKED}radydrewniane.pl/6Ejz4Y.php?{random letter}={random values}
• http://{BLOCKED}andblings.com/RWH6sC.php?{random letter}={random values}
• http://{BLOCKED}n.ca/IlDH1J.php?{random letter}={random values}
• http://{BLOCKED}nltd.kz/_aP5Qm.php?{random letter}={random values}
• http://{BLOCKED}mode.nl/DaZjW7.php?{random letter}={random values}
• http://{BLOCKED}ance-pc.fr/DzJuMa.php?{random letter}={random values}
• http://{BLOCKED}a-b.pl/WBxm6M.php?{random letter}={random values}
• http://{BLOCKED}gar.com/K1kCOF.php?{random letter}={random values}
• http://{BLOCKED}rd-marine.com/Rd8pPK.php?{random letter}={random values}
• http://{BLOCKED}al-club-boeckels.de/kiCsmO.php?{random letter}={random values}
• http://{BLOCKED}oucomprar.com/cNabw1.php?{random letter}={random values}
• http://{BLOCKED}a.su/wlI0Uy.php?{random letter}={random values}
• http://{BLOCKED}s-krombach.de/F74yDk.php?{random letter}={random values}
• http://{BLOCKED}ballvideobwsl.net/jN3vUi.php?{random letter}={random values}
• http://{BLOCKED}kdental.com/GMu28q.php?{random letter}={random values}
• http://{BLOCKED}ium.altervista.org/cUFD6S.php?{random letter}={random values}

It renames encrypted files using the following names:

• {random characters}.{random characters}

It deletes itself after execution.

It is capable of encrypting files in the affected system.